Rubicon contest - 0xNoah's results

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathToken.sol#L629-L653

Vulnerability details

Impact

Due to rewardsVestingWallet not being set, the condition in the Proof of Concept below will always evaluate to false, thus resulting in the rewards funds never being released - leading to asset loss for beneficiary.

Proof of Concept

if (rewardsVestingWallet != IBathBuddy(0)) { // always false
    rewardsVestingWallet.release(
        (token),
        receiver,
        sharesWithdrawn,
        initialTotalSupply,
        feeBPS
    );
}

Tools Used

None

Recommended Mitigation Steps

Initialize rewardsVestingWallet in constructor or a separate setter function.